A VPN design will connect 200 branch firewalls to two hubs. If one branch device is stolen, the team must cut it off quickly without changing configuration on the hubs or on the other 199 branches. Which peer authentication method fits, and why?
Select an answer to reveal the explanation.
Short Explanation
With preshared keys, cutting someone off means changing locks; with certificates, you just cancel one badge. Revoke the stolen branch's certificate, and the hubs reject it while the other 199 keep working untouched. The trap is thinking IKE has some revocation list for PSKs — it doesn't.
Full Explanation
Certificate-based peer authentication scales because each peer proves its identity with its own certificate signed by a common CA, and every peer trusts that CA rather than holding a secret per neighbor. When a device is stolen, the administrator revokes its certificate; hubs that check revocation through a CRL or OCSP refuse the device during IKE authentication, while every other branch is unaffected and no hub configuration changes. New branches likewise need only an enrolled certificate. A single shared preshared key means changing it on the hubs breaks all 199 legitimate branches, which defeats the requirement. Unique preshared keys per branch limit exposure, but removing the stolen key still requires editing the hub configuration, and IKE has no revocation mechanism for preshared keys. Preshared keys do not expire on their own; rotation is a manual or scripted change applied on both ends, and it offers no immediate way to cut off a single device. Exam caveat: certificate authentication depends on accurate clocks and reachable revocation checking, so NTP and CRL or OCSP availability become operational dependencies. Post-quantum planning affects the signature and key-exchange algorithms used here, not the revocation model. Operational check: revoke a test certificate and confirm the hub's IKE negotiation with that device fails on authentication while other tunnels stay up.